Bug Description
After a recent update, our n8n instance hosted on Zeabur is no longer accepting POST requests from a browser-based HTML form to a Wait node's webhook URL. The browser's developer console shows a CORS preflight error, specifically that the OPTIONS request fails because no 'Access-Control-Allow-Origin' header is present in the response.
This issue occurs even when the N8N_CORS_ALLOW_ORIGIN=* and other related CORS environment variables are correctly set. Direct POST requests to the same URL using curl work perfectly, which isolates the problem to the browser's handling of CORS preflight requests.
To Reproduce
-
Create a simple n8n workflow that starts with a "Manual" trigger and connects to a "Wait" node.
-
Execute the workflow so that it is actively paused and listening at the Wait node's URL.
-
Use a simple HTML form, hosted in an environment that has a null origin (like a local file:// or an online editor like JSFiddle/CodePen), to send a POST request with a JSON body to the Wait node's URL.
<script> fetch('YOUR_WAIT_NODE_URL', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ message: 'hello' }) }).then(res => console.log(res)).catch(err => console.error(err)); </script>
- Open the browser's developer tools and observe the Network tab. The OPTIONS preflight request will fail with a CORS error.
Expected behavior
The n8n service should correctly respond to the OPTIONS preflight request with the appropriate Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers, allowing the subsequent POST request from the browser to proceed.
Debug Info
The issue didn't occur for version 1.100.4
Access to fetch at 'https:///webhook-waiting/...' from origin 'null' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
Operating System
Ubuntu Linux 22.04
n8n Version
1.106.1
Node.js Version
22.16.0
Database
PostgreSQL
Execution mode
main (default)
Hosting
self hosted
Bug Description
After a recent update, our n8n instance hosted on Zeabur is no longer accepting POST requests from a browser-based HTML form to a Wait node's webhook URL. The browser's developer console shows a CORS preflight error, specifically that the OPTIONS request fails because no 'Access-Control-Allow-Origin' header is present in the response.
This issue occurs even when the N8N_CORS_ALLOW_ORIGIN=* and other related CORS environment variables are correctly set. Direct POST requests to the same URL using curl work perfectly, which isolates the problem to the browser's handling of CORS preflight requests.
To Reproduce
Create a simple n8n workflow that starts with a "Manual" trigger and connects to a "Wait" node.
Execute the workflow so that it is actively paused and listening at the Wait node's URL.
Use a simple HTML form, hosted in an environment that has a null origin (like a local file:// or an online editor like JSFiddle/CodePen), to send a POST request with a JSON body to the Wait node's URL.
<script> fetch('YOUR_WAIT_NODE_URL', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ message: 'hello' }) }).then(res => console.log(res)).catch(err => console.error(err)); </script>Expected behavior
The n8n service should correctly respond to the OPTIONS preflight request with the appropriate Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers, allowing the subsequent POST request from the browser to proceed.
Debug Info
The issue didn't occur for version 1.100.4
Access to fetch at 'https:///webhook-waiting/...' from origin 'null' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
Operating System
Ubuntu Linux 22.04
n8n Version
1.106.1
Node.js Version
22.16.0
Database
PostgreSQL
Execution mode
main (default)
Hosting
self hosted